The reason is very simple. NTLite is editing the uninstalled offline image. Sysprep is capturing a mostly installed image.I've always been curious as to how NTLite is able to keep the ISO file consistent where as when I complete a similar set of changes on an ISO and just Sysprep + Imaging Tools Environment to capture an image from a Hyper-V machine, I get a huge ISO.
Pass 1 | WinPE extracts install image and loads drivers; preps Windows for reboot |
Pass 2 | Reboot into specialize/audit phases, Windows does more system setup tasks |
Pass 3 | Reboot and perform OOBE, provision UWP apps |